policyBased

Tunnels require a policy with action tunnel to trigger IPsec VPN. The device receives traffic and matches it with policy that has action tunnel, then performs the encryption/decryption and authentication options negotiated for this VPN Phase 2 negotiation.

(1)

routeBased

Requires a tunnel interface to a route directing traffic to protected networks to exit the system using that tunnel interface. The tunnel interface is bound to a Phase 2 VPN configuration that specifies all the tunnel parameters.

(2)